diff --git a/NEWS b/NEWS index 039c31e9..974ef649 100644 --- a/NEWS +++ b/NEWS @@ -9,6 +9,10 @@ NEWS ( CHANGELOG and HISTORY ) HTMLPurifier . Internal change ========================== +4.9.0, unknown release date +! %URI.DefaultScheme can now be set to null, in which case + all relative paths are removed. + 4.8.0, released 2016-07-16 # By default, when a link has a target attribute associated with it, we now also add rel="noreferrer" in order to diff --git a/configdoc/usage.xml b/configdoc/usage.xml index c3fe3f81..d80ab51e 100644 --- a/configdoc/usage.xml +++ b/configdoc/usage.xml @@ -423,13 +423,13 @@ - 183 + 185 - 200 - 216 + 202 + 218 diff --git a/library/HTMLPurifier/ConfigSchema/schema.ser b/library/HTMLPurifier/ConfigSchema/schema.ser index 0a7a406e..0def14c8 100644 Binary files a/library/HTMLPurifier/ConfigSchema/schema.ser and b/library/HTMLPurifier/ConfigSchema/schema.ser differ diff --git a/library/HTMLPurifier/ConfigSchema/schema/URI.DefaultScheme.txt b/library/HTMLPurifier/ConfigSchema/schema/URI.DefaultScheme.txt index 728e378c..834bc08c 100644 --- a/library/HTMLPurifier/ConfigSchema/schema/URI.DefaultScheme.txt +++ b/library/HTMLPurifier/ConfigSchema/schema/URI.DefaultScheme.txt @@ -1,5 +1,5 @@ URI.DefaultScheme -TYPE: string +TYPE: string/null DEFAULT: 'http' --DESCRIPTION-- @@ -7,4 +7,9 @@ DEFAULT: 'http' Defines through what scheme the output will be served, in order to select the proper object validator when no scheme information is present.

+ +

+ Starting with HTML Purifier 4.9.0, the default scheme can be null, in + which case we reject all URIs which do not have explicit schemes. +

--# vim: et sw=4 sts=4 diff --git a/library/HTMLPurifier/URI.php b/library/HTMLPurifier/URI.php index a5e7ae29..9c5be39d 100644 --- a/library/HTMLPurifier/URI.php +++ b/library/HTMLPurifier/URI.php @@ -85,11 +85,13 @@ class HTMLPurifier_URI $def = $config->getDefinition('URI'); $scheme_obj = $def->getDefaultScheme($config, $context); if (!$scheme_obj) { - // something funky happened to the default scheme object - trigger_error( - 'Default scheme object "' . $def->defaultScheme . '" was not readable', - E_USER_WARNING - ); + if ($def->defaultScheme !== null) { + // something funky happened to the default scheme object + trigger_error( + 'Default scheme object "' . $def->defaultScheme . '" was not readable', + E_USER_WARNING + ); + } // suppress error if it's null return false; } } diff --git a/tests/HTMLPurifier/AttrDef/URITest.php b/tests/HTMLPurifier/AttrDef/URITest.php index d2c5d7ab..f4002173 100644 --- a/tests/HTMLPurifier/AttrDef/URITest.php +++ b/tests/HTMLPurifier/AttrDef/URITest.php @@ -81,6 +81,12 @@ class HTMLPurifier_AttrDef_URITest extends HTMLPurifier_AttrDefHarness $this->assertDef('http://example.com/foo/bar'); } + public function testDefaultSchemeNull() + { + $this->config->set('URI.DefaultScheme', null); + $this->assertDef('foo', false); + } + public function testAltSchemeNotRemoved() { $this->assertDef('mailto:this-looks-like-a-path@example.com');